Nexcess
Monthly
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Broken access control in the Event Tickets WordPress plugin (versions up to and including 5.28.5) lets remote unauthenticated attackers modify data they should not be able to reach because an authorization check is missing on a privileged action. The flaw carries a 7.5 CVSS with an integrity-only impact (I:H) and no confidentiality or availability effect, and there is no public exploit identified at time of analysis. It was disclosed by Patchstack and affects default installations of the plugin.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated vector warrants prompt patching given the plugin's broad deployment footprint.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Broken access control in the Event Tickets WordPress plugin (versions up to and including 5.28.5) lets remote unauthenticated attackers modify data they should not be able to reach because an authorization check is missing on a privileged action. The flaw carries a 7.5 CVSS with an integrity-only impact (I:H) and no confidentiality or availability effect, and there is no public exploit identified at time of analysis. It was disclosed by Patchstack and affects default installations of the plugin.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated vector warrants prompt patching given the plugin's broad deployment footprint.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.